Ellis vs Hub International Limited Settlement: What 514,000 Victims Need to Know Before September

The way significant data breaches typically transpire is subtly unsettling. Weeks or months after strangers have already entered the digital door of your most private information, there is no explosion, no visible wreckage, just a silent notification that arrives in the mail. For over 500,000 individuals associated with Hub International Limited, one of the biggest insurance brokers in North America, that is essentially what happened.

Cybercriminals gained access to Hub’s internal systems and made copies of files between December 2022 and January 2023. We’re talking about more than just names and email addresses; we’re talking about Social Security numbers, passport information, driver’s license numbers, financial account details, and, frequently, health insurance and medical records.

Category	Details
Company Name	Hub International Limited
Industry	Insurance Brokerage
Headquarters	Chicago, Illinois, USA
Incident Type	Cybersecurity Data Breach
Breach Period	December 2022 – January 2023
Individuals Affected	514,477
Settlement Amount	$4.65 Million
Compensation Options	Up to $5,000 (documented losses) or $150 Alternative Cash Payment
Claim Deadline	September 8, 2025
Opt-Out / Objection Deadline	August 8, 2025
Court Hearing Date	October 6, 2025, 10:00 AM CT
Data Exposed	Names, SSNs, Driver’s License, Passport Numbers, Financial & Medical Info
Official Settlement Info	Ellis v. Hub International Settlement

The legal reaction to that violation is represented by the Ellis v. Hub International Limited Settlement, which is currently worth $4.65 million. Because it is a class action resolution, it affects a large number of people, including current and former Hub employees, those for whom Hub managed insurance policies, and those connected to insurance companies and employers Hub collaborated with. It’s worth taking a moment to consider the scope of that definition.

The customer database of one company was not compromised. It affected a whole ecosystem of people who trusted Hub International with their most sensitive documents, either directly or indirectly, but probably never gave it much thought on a daily basis.

There are two options available to eligible individuals under the proposed settlement terms. The first is a $5,000 maximum claim for documented out-of-pocket losses, such as fraudulent charges, credit monitoring fees you may have paid for yourself, or time spent dealing with identity theft; however, this amount may be adjusted pro rata based on the number of filers.

For those who find it difficult to prove specific losses, the second option is a flat alternative cash payment of $150. Access to credit monitoring and identity theft protection services is another benefit of both options. Depending on your level of charity toward the company that neglected to protect that information in the first place, this can be either a meaningful or somewhat ironic gesture.

It’s difficult to ignore how important “pro rata” actually is in real life. Tens of thousands of claims could result in a reduction of that $5,000 cap. The $150 amount might also change. Many claimants may not fully comprehend this until the checks arrive, or they may not comprehend it at all. This kind of ambiguity is inherent in settlements, and even when the payout appears substantial on paper, it typically benefits the defendant more than the plaintiffs.

September 8, 2025 is the deadline for submitting a claim via mail or online. By August 8, 2025, anyone who wants to stay out of the settlement and keep their right to sue Hub on their own must postmark their request. The court must receive objections by the same August deadline. On October 6, 2025, at 10:00 AM Central Time, there will be a fairness hearing where anyone, with or without legal representation, can appear and discuss the terms of the settlement with the court.

The company has not publicly disputed the fundamental facts of what transpired, and Hub International revealed the breach through an official data breach notice. After gaining access and copying files, an unidentified actor departed.

Notification and, ultimately, this settlement were the company’s responses. The legal resolution doesn’t really address whether that is sufficient accountability for an organization entrusted with this amount of sensitive data. Settlements are approved by courts based on their reasonableness rather than their sufficiency.

The kind of data involved in this case is what makes it worthwhile to follow beyond the legal details. Not only are health insurance and medical records financially sensitive, but they also carry a level of intimacy that other compromised data does not.

It’s unsettling when someone knows your bank account number. It’s quite different when someone might be aware of your medical history. Many claimants find it challenging to know where to begin when documenting their losses because it is still unclear exactly which individuals lost which particular categories of data.

As this specific settlement develops, a larger narrative about the insurance industry’s relationship with data security emerges. Ironically, the insurance industry exists to manage risk on behalf of others. The Ellis v. Hub International Limited Settlement may settle the case, but it doesn’t address the more fundamental issue of how businesses are safeguarding this much personal data.

The most practical course of action for the 514,477 impacted individuals is currently straightforward: determine your eligibility, fill out the claim form, and submit it by September 8th. What happened cannot be reversed. However, it may be the only material benefit this circumstance ever provides.